Vulnerability Description
Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Langfuse | Langfuse | >= 2.95.0, < 2.95.12 |
Related Weaknesses (CWE)
References
- https://github.com/langfuse/langfuse/security/advisories/GHSA-w9pw-c549-5m6wMitigationVendor Advisory
FAQ
What is CVE-2025-65107?
CVE-2025-65107 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AU...
How severe is CVE-2025-65107?
CVE-2025-65107 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-65107?
Check the references section above for vendor advisories and patch information. Affected products include: Langfuse Langfuse.